 objecttothis
|
9253cfe836
|
test(config): add coverage for email/locale/general security fixes (#4782)
Add ConfigControllerTest covering validation added to protect
config save endpoints from injection and bypass attacks.
- Mailpath validation: accept legit sendmail paths (with dots,
trailing args), require mailpath when protocol is sendmail,
reject command injection via shell metacharacters (e.g.
semicolon) for both sendmail and non-sendmail protocols
- postSaveLocale: verify payment_reference_code_min/max bounds
(reject non-numeric, zero, negative, max < min; accept valid
and min==max cases)
- postSaveLocale: verify language_code allow-list enforcement
against path traversal (forward/backslash variants), unknown
languages, and case-mismatched codes (GHSA-related hardening)
- postSaveGeneral: begin coverage of theme validation with a
reusable base payload builder
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
|
2026-10-26 18:12:52 +04:00 |
|